summaryrefslogtreecommitdiffstats
Commit message (Collapse)AuthorAgeFilesLines
...
* dm-verity: document the meta-intel dependency in the systemd examplePaul Gortmaker2023-05-131-0/+1
| | | | | | | The dependency might not be obvious to everyone, so leave a hint. Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity: don't make read-only-rootfs sound like a requirementPaul Gortmaker2023-05-131-2/+9
| | | | | | | | | | | | | | | | | | | | | | | | | Adding to your local.conf right out of the gate: EXTRA_IMAGE_FEATURES = "read-only-rootfs" while you are trying to sort out other things can be just another complication to an already steep learning curve. For example, I found simply enabling this with systemd caused: systemd[1]: Failed to fork off sandboxing environment for executing generators: Protocol error [!!!!!!] Failed to start up manager. systemd[1]: Freezing execution. While I'd like to get to the root cause of that, it doesn't change that things boot fine w/o adding to EXTRA_IMAGE_FEATURES, even though the rootfs is still read-only courtesy of dm-verity. Reword things so as to make it clear it isn't strictly a hard requirement and hence can be delayed as people work through their implementation. Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* dm-verity: ensure people don't ignore the DISTRO_FEATURES warningPaul Gortmaker2023-05-131-0/+2
| | | | | | | | | | | | | | | Some platform creators tend to list a whole bunch of layers by default in conf/bblayers.conf. Without getting into the debate of whether that is a good idea, it can tend to have the effect of people seeing the meta-security DISTRO_FEATURES warning time and time again and becoming essentially numb to it. After having fallen into this trap myself, I figured it was worth the extra mention in the dm-verity doc so there is a better chance of users realizing "hey - this applies to me!". Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* integrity: Rename linux-%.bbappend to linux-yocto%.bbappendStefan Berger2023-05-131-0/+0
| | | | | | | | To avoid having linux-%.bbappend included in targets unrelated to the linux kernel, rename linux-%.bbappend to linux-yocto%.bbappend. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* integrity: Fix the do_configure functionStefan Berger2023-05-131-2/+4
| | | | | | | | | | | Append ':append' to do_configure so it does not replace all existing do_configure's. Only run 'sed' when DISTRO_FEATURES contains 'ima' and the .config file exists. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Drop kernel config option CONFIG_SQUASHFS_XATTR=y from ima.cfgStefan Berger2023-05-131-1/+0
| | | | | | | | Drop the kernel config option CONFIG_SQUASHFS_XATTR=y from ima.cfg. Instead, require projects that use squashfs to set this option. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux: overlayfs: Drop kernel patch resolving a file change notification issueStefan Berger2023-05-132-43/+0
| | | | | | | | | | | Revert the patch resolving a file change notitfication issue (for IMA appraisal) since this patch fails in 'many downstream kernels'. - https://lists.yoctoproject.org/g/yocto/message/59928 - https://lists.yoctoproject.org/g/yocto/message/59929 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-security-tpm2: restore pkgs removed earlierArmin Kuster2023-05-061-0/+5
| | | | | | | | | commit: 0594aee packagegroup-security-tpm2.bb: remove dynamic pkgs is causing an issue with some users. Restore the packages and opted to fix via PACKAGE_ARCH = "${TUNE_PKGARCH}" Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-parsec/layer.conf: Insert addpylib declarationPeter Hoyes2023-05-061-0/+2
| | | | | | | | | | | | Yocto mickledore introduced the addpylib directive for explicitly adding layer paths to the PYTHONPATH. Standalone OEQA test suite discovery does not require this directive but it is required to import test cases from other layers, e.g. to extend and modify the test cases. Signed-off-by: Peter Hoyes <Peter.Hoyes@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss: drop vendor from PACKAGECONFIGArmin Kuster2023-05-061-1/+1
| | | | | | | fixes: WARNING: tpm2-tss-4.0.1-r0 do_configure: QA Issue: tpm2-tss: invalid PACKAGECONFIG: vendor [invalid-packageconfig] Signed-off-by: Armin Kuster <akuster808@gmail.com>
* openembedded-release: drop as os-release does this nowArmin Kuster2023-05-061-32/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* os-release.bbappend: drop now CPE_NAME is in coreArmin Kuster2023-05-061-1/+0
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* lynis: Add decoding OE and PokyArmin Kuster2023-05-062-1/+54
| | | | | | Patch sent upstream. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libmhash: fix multilib header conflict - mutils/mhash_config.hAdrian Zaharia2023-05-061-1/+5
| | | | | | | Header file conflict between 32-bit and 64-bit versions Signed-off-by: Adrian Zaharia <Adrian.Zaharia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* integrity-image-minimal: adapt QEMU cmdline to new changesArmin Kuster2023-05-061-1/+1
| | | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* oeqa: fix hash test to match new changesArmin Kuster2023-05-061-6/+4
| | | | | | Signed-off-by: Armin Kuster <akuster808@gmail.com> Reviewed-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: Update ima-evm-utils to v1.5 and add a patchStefan Berger2023-05-062-2/+42
| | | | | Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* linux: overlayfs: Add kernel patch resolving a file change notification issueStefan Berger2023-05-062-0/+43
| | | | | | | | | | | | | Add a temporary patch that resolves a file change notification issue with overlayfs where IMA did not become aware of the file changes since the 'lower' inode's i_version had not changed. The issue will be resolved in later kernels with the following patch that builds on newly addd feature (support for STATX_CHANGE_COOKIE) in v6.3-rc1: https://lore.kernel.org/linux-integrity/20230418-engste-gastwirtschaft-601fb389bba5@brauner/T/#m3bf84296fe9e6499abb6e3191693948add2ff459 Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* integrity: Update the README for IMA supportStefan Berger2023-05-061-9/+11
| | | | | | | Update the README describing how IMA support can be used. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Sign all executables and the ima-policy in the root filesystemStefan Berger2023-05-061-5/+20
| | | | | Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Rename IMA_EVM_POLICY_SYSTEMD to IMA_EVM_POLICYStefan Berger2023-05-062-3/+3
| | | | | | | | | The IMA policy will be specified using the IMA_EVM_POLICY variable since systemd will not be involved in loading the policy but the init script will load it. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Fix the IMA kernel featureStefan Berger2023-05-067-251/+63
| | | | | | | | Fix the IMA kernel feature. Remove outdated patches and add ima.cfg holding kernel configuration options for IMA and EVM. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Fix the ima_policy_appraise_all to appraise executables & librariesStefan Berger2023-05-061-1/+8
| | | | | | | | | Fix the ima_policy_appraise_all policy to appraise all executables and libraries. Also update the list of files that are not appraised to not appraise cgroup related files. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima: Document and replace keys and adapt scripts for EC keysStefan Berger2023-05-068-62/+50
| | | | | | | | | | For shorted file signatures use EC keys rather than RSA keys. Document the debug keys and their purpose. Adapt the scripts for creating these types of keys to now create EC keys. Signed-off-by: Stefan Berger <stefanb@linux.ibm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* maintainers.inc: rename to avoid clashes with oe-coreAlexander Kanavin2023-05-062-0/+0
| | | | | | | | | | Additional maintainer entries should be added to ones provided by oe-core, but not be replacing them, as that breaks oe-core tests. Another option is to place them directly into recipes. Signed-off-by: Alexander Kanavin <alex@linutronix.de> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* fscryptctl: update to 1.0.1Armin Kuster2023-05-061-1/+6
| | | | | | Don't build man as it needs pandoc Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: update to 6.0.11Armin Kuster2023-05-061-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libhtp: update to 0.5.43Armin Kuster2023-05-061-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ossec-hids: update to tip of 3.7.0Armin Kuster2023-05-061-1/+1
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libtpm: update to 0.9.6Armin Kuster2023-05-061-1/+1
| | | | | | include: CVE-2023-1017 & CVE-2023-1018 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* swtpm: update to 0.8.0Armin Kuster2023-05-061-2/+2
| | | | | | includes CVE-2022-23645 Signed-off-by: Armin Kuster <akuster808@gmail.com>
* recipes-tpm: use this for common tpm recipesArmin Kuster2023-05-068-0/+0
| | | | | | a bit of re-org Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-tpm: rename recipes-tpm to recipes-tpm1Armin Kuster2023-05-0628-0/+0
| | | | | | a bit of re-org. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tools: Remove unnecessary and optional dependenciesPeter Kjellerstedt2023-05-061-4/+1
| | | | | | | | | | | | | | | * The dependency on autoconf-archive is only needed when building from the Git repository (and it should really be autoconf-archive-native). * Removing the build dependency on tpm2-abrmd does not change the output in any way, i.e., nothing is used from it. * The runtime dependency on libtss2 is added automatically by bitbake since /usr/bin/tpm2 is linked with libtss2-esys.so.0. * The runtime dependency on tpm2-abrmd is optional. Such dependencies are better handled at a higher level, e.g., by depending on packagegroup-security-tpm2. Signed-off-by: Peter Kjellerstedt <peter.kjellerstedt@axis.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* Flush caches after OEQA testsAnton Antonov2023-04-141-0/+4
| | | | | | | Make sure that all changes a saved after running the tests. Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* Fix PACKAGECONFIG check in Parsec OEQA testsAnton Antonov2023-04-121-2/+11
| | | | | | | | If PACKAGECONFIG is not defined in local.conf then its default value is not included in cls.tc.td map. Signed-off-by: Anton Antonov <Anton.Antonov@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* parsec-service: fix SRC_URI hashArmin Kuster2023-04-121-1/+3
| | | | | | | | | | | | | Fixes: ERROR: Missing SRC_URI checksum, please add those to the recipe: SRC_URI[parsec-service-1.2.0.sha256sum] = "f58e7ba859c22cc1904dc8298b1a7d94ee1ba3b4d4808f28e4cc0c96ddb149c9" Needed to S dir too. Signed-off-by: Armin Kuster <akuster808@gmail.com> v2] Fix patch applying
* parsec-tool: update SRC_URI hashArmin Kuster2023-04-121-2/+4
| | | | | | | | | | | | | | | | | | FIxes: ERROR: Missing SRC_URI checksum, please add those to the recipe: SRC_URI[parsec-tool-0.6.0.sha256sum] = "f51d5d7f0caca1c335324b52482fa5edbf6c9cfd2e6865e5cb22716d52dcb367" Needed to have the package version included in the name. Fixes: ERROR: parsec-tool-0.6.0-r0 do_populate_lic: QA Issue: parsec-tool: LIC_FILES_CHKSUM points to an invalid file: and error: manifest path `/home/akuster/oss/clean/poky/build/tmp/work/cortexa53-poky-linux/parsec-tool/0.6.0-r0/parsec-tool-0.6.0//Cargo.toml` does not exist Set S to CARGO_VENDORING_DIRECTORY/BP to fix the LIC_FILES_CHKSUM and compile errors. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* parsec-service: Update parsec recipes to 1.2.0 and parsec-tool to 0.6.0Gowtham Suresh Kumar2023-04-126-408/+821
| | | | | Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* meta-parsec: Disable RSA-OAEP OEQA tests for Parsec PKCS11 backendGowtham Suresh Kumar2023-04-121-3/+5
| | | | | Signed-off-by: Gowtham Suresh Kumar <gowtham.sureshkumar@arm.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* libwhisker2-perl: adjust perl-version variablePatrick Williams2023-04-081-3/+4
| | | | | | | | | | | | The PERLVERSION likely has the wrong value in the native context due to reasons discussed in openembedded-core[1]. The upstream suggestion was to avoid use of PERLVERSION and switch to the direct function. 1. https://lore.kernel.org/openembedded-core/20230405003850.384813-1-patrick@stwcx.xyz/T/#u Signed-off-by: Patrick Williams <patrick@stwcx.xyz> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: Missed on crate dependsArmin Kuster2023-04-081-0/+2
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* suricata: Fixup to work within the recent crate changes.Armin Kuster2023-04-082-90/+725
| | | | | | | | Had to delete some wonky Cargo.toml files to get update_crates to work. Manually updated one crate to a newer version included by update_crates as it would not compile. Manually applied several crates missed by update_crates. Signed-off-by: Armin Kuster <akuster808@gmail.com>
* krill: forced to inclued fetch hashes.Armin Kuster2023-04-083-281/+552
| | | | | | | | | | Now manditory via Poky commit: https://git.yoctoproject.org/poky/commit/bitbake/lib/bb/fetch2?id=4d9886e1435dba3785973cc920865f8ab67e644d used cargo-update-recipe-crates to fixup Drop krill.inc in favor of new crate file name Signed-off-by: Armin Kuster <akuster808@gmail.com>
* checksecurity: update to 2.0.16Armin Kuster2023-04-083-65/+21
| | | | | | | Drop setuid-log-folder.patch, using sed instead. Refresh patch check-setuid-use-more-portable-find-args.patch Signed-off-by: Armin Kuster <akuster808@gmail.com>
* tpm2-tss: correct CVE productPeter Marko2023-03-261-0/+2
| | | | | | | | | | | | | | | | | Currently CVE-2023-22745 does not show up in kirkstone CVE report. This fixes that. Products from yocto's CVE check NVD database: sqlite> select * from products where product like "tpm2%"; CVE-2017-7524|tpm2-tools_project|tpm2.0-tools|||1.1.0|<= CVE-2020-24455|tpm2_software_stack_project|tpm2_software_stack|||2.4.3|< CVE-2020-24455|tpm2_software_stack_project|tpm2_software_stack|3.0.0|>=|3.0.1|< CVE-2021-3565|tpm2-tools_project|tpm2-tools|5.1|>=|5.1.1|< CVE-2021-3565|tpm2-tools_project|tpm2-tools|||4.3.2|< CVE-2023-22745|tpm2_software_stack_project|tpm2_software_stack|||4.0.0|<= Signed-off-by: Peter Marko <peter.marko@siemens.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* ima-evm-utils: disable documentation from buildMikko Rapeli2023-03-261-0/+1
| | | | | | | | Building documentation fails due to missing asciidoc, xsltproc etc so it's better to just disable building them by default. Signed-off-by: Mikko Rapeli <mikko.rapeli@linaro.org> Signed-off-by: Armin Kuster <akuster808@gmail.com>
* packagegroup-core-security: refactor the inclusion of krillArmin Kuster2023-03-221-6/+6
| | | | Signed-off-by: Armin Kuster <akuster808@gmail.com>
* cryptmout: update to 6.2.0Armin Kuster2023-03-201-5/+3
| | | | | | Change LIC_FILES_CHKSUM to use COPYING Signed-off-by: Armin Kuster <akuster808@gmail.com>
* krill: update 0.12.3Armin Kuster2023-03-203-107/+146
| | | | | | refresh patch Signed-off-by: Armin Kuster <akuster808@gmail.com>
generated by cgit v1.2.3-54-g00ecf (git 2.39.0) at 2025-07-23 02:50:15 +0000